The token should always be sent as the last parameter, or at least after the $1text parameter.
Questions about this topic? Sign up to ask in the talk tab.
MediaWiki:Apihelp-edit-param-token
From NetSec
The token should always be sent as the last parameter, or at least after the $1text parameter.
